# Security Zines

> Hand-drawn explainers of security and infrastructure concepts, each on one dense page. 69 free posters (flyers, printer-friendly printies, sketchnotes) plus paid multi-page zines and a membership sold on Gumroad. Drawn by Rohit (X: @who_rsehgal, formerly @sec_r0) and Anshu (X: @thebitdoodler).

Every poster page has the full image, an HD download and a written explanation of the concept. All posters are free to read and share with credit. The full library is at https://securityzines.com/posters/.

## Buy

- [Security Zines Membership](https://securityzines.gumroad.com/l/securityzines-membership): Pay what you want, monthly. Every zine, including the ones not drawn yet; New zines 3 weeks before anyone else; New flyers 2 days early; A custom zine character for your X profile; Your own branding on any zine, to show your team.
- [Threat Modelling zine](https://securityzines.com/zines/threat-modelling): $2+. The basics of a threat model, with fun.
- [Phishing zine](https://securityzines.com/zines/phishing): $5+. The most notorious security issue, and how the bait works.
- [Docker & Containers zine](https://securityzines.com/zines/docker): $6. The stack behind modern application runtimes.
- [Same Origin Policy zine](https://securityzines.com/zines/same-origin-policy): $4. The browser's security model, origin by origin.
- [CSRF zine](https://securityzines.com/zines/csrf): Free. Cross-site request forgery, end to end.
- [HTTP zine](https://securityzines.com/zines/http): not on sale yet. The language of the web.
- [SAML zine](https://securityzines.com/zines/saml): not on sale yet. Security Assertion Markup Language.
- [SQL Injection zine](https://securityzines.com/zines/sql-injection): not on sale yet. Never trust user data.
- [XSS zine](https://securityzines.com/zines/xss): not on sale yet. Cross-site scripting.
- [All flyers in HD (PDF)](https://securityzines.gumroad.com/l/allFlyersInHD): $15
- [Burp Suite Plugin Development Guide](https://securityzines.gumroad.com/l/burp-plugin-dev): $10
- [WebAuth Zine](https://securityzines.gumroad.com/l/webauthzine): $2

## Web Security

How browsers and web apps get attacked, and the controls that stop it. Topic page: https://securityzines.com/topics/web

- [Cookies & Sessions](https://securityzines.com/posters/cookies-and-sessions): How a stateless protocol remembers you
- [Session Identifiers](https://securityzines.com/posters/session-identifiers): What makes a session ID safe
- [XSS](https://securityzines.com/posters/xss): Cross-site scripting: stored, reflected and DOM
- [Burp Suite](https://securityzines.com/pages/flyers/burp): Its most-used tabs for web app testing
- [CORS](https://securityzines.com/pages/flyers/cors): Cross-Origin Resource Sharing
- [CSP](https://securityzines.com/pages/flyers/csp): Content Security Policy
- [H2C Smuggling](https://securityzines.com/pages/flyers/h2c): HTTP/2 Cleartext (h2c) Smuggling
- [HTTP Request Headers](https://securityzines.com/pages/flyers/hreqheaders): Understanding HTTP Request Headers
- [HTTP Request Smuggling](https://securityzines.com/pages/flyers/hrs): Understanding HTTP Request Smuggling
- [HTTP Response Headers](https://securityzines.com/pages/flyers/hresheaders): Understanding HTTP Response Headers
- [IDOR](https://securityzines.com/pages/flyers/idor): Insecure Direct Object Reference
- [LFI](https://securityzines.com/pages/flyers/lfi): Local File Inclusion
- [RFI](https://securityzines.com/pages/flyers/rfi): Remote File Inclusion
- [Reflected XSS](https://securityzines.com/pages/flyers/rxss): Cross-Site Scripting
- [Regex DoS](https://securityzines.com/pages/flyers/redos): Regular Expression Denial of Service
- [SOP](https://securityzines.com/pages/flyers/sop): Same Origin Policy
- [SSTI](https://securityzines.com/pages/flyers/ssti): Server-Side Template Injection
- [Stored XSS](https://securityzines.com/pages/flyers/sxss): Cross-Site Scripting
- [XXE](https://securityzines.com/pages/flyers/xxe): XML External Entity
- [Understanding HTTP Response Headers](https://securityzines.com/pages/flyers/httpresponse): Key HTTP Response Headers You Should Know (by Anshu)
- [Burp Suite (printable)](https://securityzines.com/pages/printies/BurpSuite): Web Application Security Testing
- [CORS (printable)](https://securityzines.com/pages/printies/CORS): Cross-Origin Resource Sharing
- [CSP (printable)](https://securityzines.com/pages/printies/CSP): Content Security Policy
- [H2C Smuggling (printable)](https://securityzines.com/pages/printies/H2C): HTTP/2 Cleartext (h2c) Smuggling
- [HTTP Request Headers (printable)](https://securityzines.com/pages/printies/HTTPRequestHeaders): Understanding HTTP Request Headers
- [HTTP Request Smuggling (printable)](https://securityzines.com/pages/printies/HRS): Understanding HTTP Request Smuggling
- [HTTP Response Headers (printable)](https://securityzines.com/pages/printies/HTTPResHeaders): Understanding HTTP Response Headers
- [IDOR (printable)](https://securityzines.com/pages/printies/IDOR): Insecure Direct Object Reference
- [LFI (printable)](https://securityzines.com/pages/printies/LFI): Local File Inclusion
- [RFI (printable)](https://securityzines.com/pages/printies/RFI): Remote File Inclusion
- [ReDoS (printable)](https://securityzines.com/pages/printies/ReDoS): Regular Expression Denial of Service
- [Reflected XSS (printable)](https://securityzines.com/pages/printies/RXSS): Cross-Site Scripting
- [SOP (printable)](https://securityzines.com/pages/printies/SOP): Same Origin Policy
- [SSTI (printable)](https://securityzines.com/pages/printies/SSTi): Server-Side Template Injection
- [XXE (printable)](https://securityzines.com/pages/printies/XXE): XML External Entity

## Identity & Auth

Tokens, sessions, logins and who is allowed to do what. Topic page: https://securityzines.com/topics/identity

- [JSON Web Tokens](https://securityzines.com/posters/json-web-tokens): Header, payload, signature, and how JWTs get attacked
- [OAuth 2.0 Flows](https://securityzines.com/posters/oauth-2-flows): Which grant type to use, and when
- [OAuth 2.0](https://securityzines.com/posters/oauth-2): Delegated access without sharing passwords
- [Single Sign-On](https://securityzines.com/posters/single-sign-on): One login for many apps
- [JWT](https://securityzines.com/pages/flyers/jwt): JSON Web Token
- [OpenID](https://securityzines.com/pages/flyers/openId): Streamlining Identity Authentication
- [ACL: Access Control Lists](https://securityzines.com/pages/flyers/aclp1): Access Control Lists (by Anshu)

## Networking

How packets, mail and domains actually travel. Topic page: https://securityzines.com/topics/network

- [How HTTPS Works](https://securityzines.com/posters/how-https-works): TLS: certificates, key exchange and encrypted traffic
- [Networking Models](https://securityzines.com/posters/networking-models): OSI vs TCP/IP, layer by layer
- [Network Attacks](https://securityzines.com/pages/flyers/NetworkAttacks): Network Attacks and Security
- [OSI vs. TCP/IP Network Models](https://securityzines.com/pages/flyers/Networkingmodels): The model behind the internet
- [CDN: Content Delivery Networks](https://securityzines.com/pages/flyers/cdn): Content Delivery Network (by Anshu)
- [The Future of Decentralized Web Addresses](https://securityzines.com/pages/flyers/cryptodomains): Crypto Domains 101 (by Anshu)
- [How Email Works?](https://securityzines.com/pages/flyers/howemailworks): End-to-End Email Working (by Anshu)
- [Network Attacks (printable)](https://securityzines.com/pages/printies/NetworkAttacks): Network Attacks and Security

## Cloud & Containers

Docker, kubernetes, infrastructure and data at scale. Topic page: https://securityzines.com/topics/cloud

- [DB Sharding](https://securityzines.com/posters/db-sharding): Splitting one database across many machines
- [DB Types](https://securityzines.com/posters/db-types): Relational, document, key-value, graph and more
- [Docker & Internals](https://securityzines.com/posters/docker-internals): Namespaces, cgroups and the union filesystem
- [Kubernetes Architecture](https://securityzines.com/posters/kubernetes-architecture): Control plane and worker nodes
- [Kubernetes](https://securityzines.com/posters/kubernetes): Orchestrating containers at scale
- [DIND](https://securityzines.com/pages/flyers/dind): Docker-in-Docker
- [IaC](https://securityzines.com/pages/flyers/iac): Infrastructure as Code
- [Kubernetes Architecture](https://securityzines.com/pages/flyers/k8sarch): Understanding Kubernetes Architecture

## DevSecOps

Pipelines, secrets, tooling and thinking like an attacker. Topic page: https://securityzines.com/topics/devsecops

- [CI/CD Pipelines](https://securityzines.com/posters/ci-cd-pipelines): From commit to production, automatically
- [Git vs GitHub](https://securityzines.com/posters/git-vs-github): The tool versus the hosting platform
- [Canary Tokens](https://securityzines.com/pages/flyers/canarytoken): Early Warning Mechanisms
- [Canary Tokens (printable)](https://securityzines.com/pages/printies/CanaryTokens): Early Warning Mechanisms
- [Compromising CICD (printable)](https://securityzines.com/pages/printies/CompromisingCICD): How attackers abuse CI/CD pipelines
- [Git Secrets Leaks (printable)](https://securityzines.com/pages/printies/GitSecretsLeaks): How secrets leak through Git history
- [ggshield (printable)](https://securityzines.com/pages/printies/ggshield): Scanning every stage of the SDLC for secrets

## Linux Internals

What lives under /dev and /proc. Topic page: https://securityzines.com/topics/linux

- [Linux /dev Directory](https://securityzines.com/pages/flyers/ldev): Linux Device Files
- [Linux /proc Filesystem](https://securityzines.com/pages/flyers/lproc): Linux /proc Filesystem
- [Linux /dev Directory (printable)](https://securityzines.com/pages/printies/LinuxDev): Linux Device Files
- [Linux /proc Filesystem (printable)](https://securityzines.com/pages/printies/LinuxProc): Linux /proc Filesystem

## Optional

- [Newsletter](https://securityzines.substack.com)
- [Shop](https://securityzines.gumroad.com/)
- [Full text of every poster explanation](https://securityzines.com/llms-full.txt)
- [Sitemap](https://securityzines.com/sitemap.xml)